{"id":120868,"url":"https://alion.io/job/saviynt-l3-soc-analyst","title":"L3 SOC Analyst","company":{"id":5841,"name":"Saviynt","domain":"saviynt.com","url":"https://alion.io/company/saviynt","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"A","score":93,"open_postings":61,"ghost_share":0.033,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":161,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United Kingdom"],"countries":["GB"],"hiring_countries":["GB"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":97000,"max_usd":177000,"period":"year","method":"role_seniority_country_cell","sample_n":41},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Crowdstrike","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Kubernetes","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-03-04T11:09:21Z","employer_posted_date":"2026-03-04","last_verified_at":"2026-10-23T15:50:41Z","board_verified":true,"closed_at":null,"days_open":233,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":232},"description":"Location: United Kingdom\nType: Full-time, permanent\nDue to the nature of the UK Government projects this role supports, this position is classified as a Reserved Post. In accordance with the Civil Service Nationality Rules, paragraph 1 of Schedule 23 and paragraph 5 of Schedule 22 of the Equality Act 2010, we can only accept applications from persons with UK residency (at least five years).\nSuccessful candidates must undergo National Security Vetting (NSV). This role requires Security Check SC level clearance as a minimum. Any offer of employment is strictly conditional upon the candidate successfully obtaining and maintaining this clearance.\nTo meet the vetting criteria, you will be required to have been resident in the UK for a minimum of 5 years immediately prior to your application. Failure to obtain clearance or a lapse in residency history may result in the withdrawal of the employment offer, and you will not be entitled to any compensation from Saviynt as a result.\nIn line with the Immigration, Asylum and Nationality Act 2006, all shortlisted candidates will be required to provide original documentation verifying their Right to Work in the UK and their British Citizenship during the initial interview stage. We conduct thorough Baseline Personnel Security Standard (BPSS) checks as a precursor to all higher-level clearances.\nRole Overview:\nWe are establishing a modern Security Operations Centre designed to deliver proactive, intelligence-driven security outcomes. Moving beyond traditional reactive monitoring, our SOC emphasises AI, automation, detection engineering, and deep cloud security visibility to identify and neutralise sophisticated threats at scale.\nThe L3 SOC Analyst will act as the senior technical escalation point within the SOC, leading complex investigations, driving automation initiatives, and mentoring junior analysts. This role requires strong hands-on expertise across cloud security, threat hunting, incident response, and orchestration technologies.\nWHAT YOU WILL DO:\nIncident Response & Technical Escalation\nAct as the final escalation point for complex incidents originating from L1/L2 analysis.\nLead investigations into high-severity security events, including those impacting AWS, Kubernetes clusters and hybrid environments.\nPerform advanced forensic analysis across endpoints, cloud workloads, and network telemetry to determine root cause, impact, and remediation actions.\nCorrelate telemetry from SIEM, EDR, CSPM, and cloud-native sources to identify sophisticated attack chains.\n Security Automation & SOAR Engineering\nDesign, develop, and maintain automated response playbooks within the SOAR platform to improve response efficiency.\nBuild and maintain automation scripts (Python, go, etc.) for alert enrichment, evidence collection, and containment.\nIntegrate security platforms via APIs to enable streamlined, automated detection and response workflows.\nIdentify opportunities to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) through automation and process optimisation.\nThreat Hunting & Detection Engineering\nConduct proactive threat hunting across enterprise and cloud environments using intelligence-driven and hypothesis-based methodologies.\nServe as an SME for cloud security monitoring leveraging tools such as AWS GuardDuty, CloudTrail, CrowdStrike, and Proofpoint.\nDevelop and tune SIEM detections, correlation rules, and EDR queries aligned to MITRE ATT&CK tactics and emerging threat intelligence.\n Mentorship & Continuous Improvement\nProvide technical mentoring and guidance to L1/L2 analysts to strengthen SOC capability.\nMaintain and enhance SOC documentation including SOPs, runbooks, and response playbooks.\nAnalyse incident trends and operational metrics to recommend improvements in detection coverage, automation effectiveness, and security posture.\nWHAT YOU BRING:\nBachelor’s degree in Computer Science, Cybersecurity, or related discipline (or equivalent industry experience).\nExtensive experience in Security Operations with demonstrable time in a senior analyst, threat hunter, or L3 role.\nStrong hands-on experience in cloud security monitoring and incident response across AWS - AWS experience is essential for this role.\nProven scripting and automation capability using Python, Go, PowerShell,Bash,etc.\nPractical experience with SOAR platforms (e.g., CrowdStrike Fusion SOAR) and SIEM technologies (e.g., CrowdStrike Falcon, Splunk, QRadar, Microsoft Sentinel).\nDeep understanding of EDR tooling, host/network forensics, and detection engineering practices.\nStrong working knowledge of the MITRE ATT&CK framework and its application in threat detection and hunting.","description_format":"text","description_chars":4679,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Identity Management","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-03-04T11:09:21Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Senior or Specialist Worker, Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Business Mobility: Senior or Specialist Worker; Skilled Worker","cap_exempt":false,"checked_at":"2026-10-23T06:21:00+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":38,"band":"fade","label":"Fading","p_open":1,"p_active":0.866,"p_room":0.44,"age_days":232,"expected_fill_days":161,"reasons":["conf:0","velocity","win:tail","crowd:"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/saviynt-l3-soc-analyst","json_url":"https://alion.io/job/saviynt-l3-soc-analyst.json","meta":{"generated_at":"2026-10-23T19:54:27Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1138,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5841},"rest":"https://alion.io/mcp/rest/get_company?id=5841"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsaviynt-l3-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsaviynt-l3-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsaviynt-l3-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/saviynt-l3-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsaviynt-l3-soc-analyst"}]}